Restrict access to dev web app but allow JSON requests

[eluser]Aken[/eluser]
First, I would use .htaccess instead of routes to "disable" the website. If you're still developing it, then you'll obviously need access to it with proper credentials, instead of just throwing a 404 all the time.

Second, how exactly are clients accessing the API? Standard HTTP? Ajax requests only?

If the API is accessible like most RESTful API's, then I would leave access open to it, and only restrict based on any standards your API has (do they need an API key or other credentials?). If the API is only called through Ajax, then you can use the $this->input->is_ajax_request() function to filter (note - not entirely reliable - I'd stick with RESTful for an API, anyway).

Blocking access to parts depends on your app - if you're talking about blocking the website portion of it, then using .htaccess or even a server-side authorization should be plenty sufficient.